Skip to main content
cve.nowby Sazabi
← npm
npmPackage

jquery-ui

7 known vulnerabilities (4 medium), with the versions each affects and the releases that fix them.

Latest release
1.14.2 (Jan 28, 2026): no advisory affects it
Newest unaffected release
1.14.2 (Jan 28, 2026), the latest release
Advisories
7 · 4 medium
Weekly downloads
967.5K
Dependents
1,113
Releases
20 since 1.10.4 (Mar 16, 2014)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2022-31160
    Affects 1.10.4 to 1.13.1 (1.13.2 is outside it)
  • CVE-2021-41184
    Affects 1.10.4 to 1.13.0-rc.3 (1.13.0 is outside it)
  • CVE-2021-41183
    Affects 1.10.4 to 1.13.0-rc.3 (1.13.0 is outside it)
  • CVE-2021-41182
    Affects 1.10.4 to 1.13.0-rc.3 (1.13.0 is outside it)
  • CVE-2016-7103
    Affects 1.10.4 to 1.12.0-rc.2 (1.12.0 is outside it)
  • CVE-2012-6662
    No published release is affected
    No published release is affected
  • CVE-2010-5312
    No published release is affected
    No published release is affected
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 7

  • CVE-2022-31160Medium 6.1

    jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text label

    Affected: fixed in 1.13.2.

    Fixed in 1.13.2 (released Jul 14, 2022, 6 days before disclosure).

    The latest release, 1.14.2, is not affected.

    14% of jquery-ui downloads last week were affected versions (163.7K).

  • CVE-2021-41184Medium 6.5

    XSS in the `of` option of the `.position()` util

    Affected: fixed in 1.13.0.

    Fixed in 1.13.0 (released Oct 7, 2021, 19 days before disclosure).

    The latest release, 1.14.2, is not affected.

    11% of jquery-ui downloads last week were affected versions (139K).

  • CVE-2021-41183Medium 6.5

    XSS in `*Text` options of the Datepicker widget

    Affected: fixed in 1.13.0.

    Fixed in 1.13.0 (released Oct 7, 2021, 19 days before disclosure).

    The latest release, 1.14.2, is not affected.

    11% of jquery-ui downloads last week were affected versions (139K).

  • CVE-2021-41182Medium 6.5

    XSS in the `altField` option of the Datepicker widget

    Affected: fixed in 1.13.0.

    Fixed in 1.13.0 (released Oct 7, 2021, 19 days before disclosure).

    The latest release, 1.14.2, is not affected.

    11% of jquery-ui downloads last week were affected versions (139K).

  • Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML…

    Affected: fixed in 1.12.0.

    Fixed in 1.12.0 (released Jul 8, 2016, 250 days before disclosure).

    The latest release, 1.14.2, is not affected.

    1.6% of jquery-ui downloads last week were affected versions (19.6K).

  • Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before…

    Affected: fixed in 1.10.0.

    Fixed in 1.10.4 (released Mar 16, 2014, 253 days before disclosure, the advisory names 1.10.0, which was never published).

    The latest release, 1.14.2, is not affected.

    0% of jquery-ui downloads last week were affected versions (0).

  • Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to…

    Affected: from 1.7.0, fixed in 1.10.0.

    Fixed in 1.10.4 (released Mar 16, 2014, 253 days before disclosure, the advisory names 1.10.0, which was never published).

    The latest release, 1.14.2, is not affected.

    0% of jquery-ui downloads last week were affected versions (0).